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Description 

METHOD FOR DETECTING FRAUDULENT 

INTERNET TRAFFIC 

Background of Invention 

[0001] The present invention relates generally to a method for 
detecting fraudulent Internet related traffic and, more 
particularly, to a method for detecting if an affiliate web 
site is likely to send fraudulent traffic to an advertiser web 
site, in order to fraudulently increase the revenue of the 
affiliate web site in a "Pay Per Click" system. 

[0002] Internet related traffic, or visits to a web site by an Inter- 
net user, is the main statistic used by an Internet adver- 
tiser to determine where to display and how much to pay 
for its advertisement on another's web site. Typically, the 
more Internet traffic a web site that is displaying an ad- 
vertiser's advertisement is receiving, the greater the pos- 
sibility for the advertiser to have its products or services 
exposed to potential purchasers. As such, there is an in- 
centive for an advertiser to display its advertisements as 



immensely as possible in order to reach the broadest po- 
tential purchaser base. 

[0003] A common method of internet advertising includes charg- 
ing an advertiser for the exposure of its advertisement to 
all Internet users regardless if the advertisement resulted 
in the Internet user actually visiting the advertiser's site by 
clicking on the advertisement. For example, an advertiser 
may pay an affiliate site that is willing to display the ad- 
vertiser's advertisement for the number of times that the 
advertisement is displayed. While this method of advertis- 
ing offers a potentially high exposure rate to numerous 
Internet users, such simplistic exposure to such a large 
number of Internet users offers little in the form of Inter- 
net users generally interested in the advertisement, which 
would prompt the Internet user to visit the advertiser's In- 
ternet site to purchase the advertised product or service. 
For example, out of 10,000 Internet users that the adver- 
tisement was displayed to, if only 10 went to the adver- 
tiser's web site to view the advertiser's products or ser- 
vices, the advertiser must still pay for the 10,000 adver- 
tisement displays. 

[0004] It js well known that actual Internet traffic can be used as 
the main means for determining whether or not compen- 



sation should be paid by the advertiser for a referral via 
an advertisement placed on an affiliate's site, commonly 
referred to as "Pay Per Click" advertising. With Pay Per 
Click advertising, the advertiser compensates an affiliate 
only if an Internet user is actually interested in the adver- 
tisement and subsequently visits the advertiser's site by 
clicking on the advertisement displayed on the affiliate's 
site. In other words, the advertiser pays the affiliate for 
displaying the advertisement only if the advertisement is 
successful in enticing an Internet user to visit the adver- 
tiser's Internet site from the affiliate's site. As such, there 
is an incentive for the advertiser to use affiliates that have 
the potential to attract as many potential customers as 
possible, while there is an inventive to the affiliate to at- 
tract as many users that would be interested in the adver- 
tiser's advertisement in order to increase its revenue. 
[0005] Since an affiliate's compensation is based proportionally 
to the number of Internet users that are successfully redi- 
rected or referred to the advertiser's site via the advertise- 
ment displayed on the affiliate's site, there is an incentive 
for the affiliate to maximize the amount of referrals. As 
such, affiliates have devised many schemes and devices 
that fraudulently cause such referrals. For example, some 



affiliates have formed "clicl< clubs" that compensate users 
that are not interested in the advertiser's products or ser- 
vices, to repeatedly click on an advertisement link to the 
advertiser's site for a small compensation, thus maximiz- 
ing revenue for the affiliate ("incentivized clicks"). Com- 
puter programs are also used to impersonate a human 
click and thus automate the process of clicking on an ad- 
vertisement to an advertiser's site ("automated clicks"). In 
either scenario, the end result is the same in that with 
such "bad Internet traffic," the advertiser is required to 
compensate the affiliate because the advertiser cannot 
differentiate between an actual potential customer that 
clicks on the link and bad Internet traffic. As such, there is 
a need to monitor such referrals to increase the actual po- 
tential customer base, instead of the affiliate attempting 

to maximize its revenue with bad Internet traffic. 
Summary of Invention 

[0006] It is an object of the present invention to provide a 

method for detecting bad Internet traffic that originates 
from a first web site, such as an affiliate's site, and that is 
directed to a second web site, such as an advertiser's site. 

[0007] It is yet another object of the present invention to identify 
affiliate sites that are commonly known or likely to send 



bad Internet traffic to an advertiser site. 

[0008] The present invention is a unique and novel method of 
detecting and monitoring bad Internet traffic sent from a 
first web site to a second web site. The present invention 
provides the ability to quickly and efficiently identify any 
traffic source that is intentionally sending either auto- 
mated or incentivized advertisement clicks in order to 
maximize an affiliate's Pay Per Click revenue. Once the 
fraud source is identified, the Pay Per Click provider can 
block the fraud source from sending future bad Internet 
traffic on advertiser listings. 

[0009] The present invention may use a plurality of elements to 
"validate" a traffic source to determine if it is likely send- 
ing bad Internet traffic to a second website. Such elements 
may include data gathered from advertisement clicks, in- 
formation gathered from survey forms that are displayed 
to Internet users, a database including known bad Internet 
traffic sites, and subsequent administrative analysis of the 
gathered data. From the gathered data, it may be deter- 
mined to denote an affiliate site as a known or likely gen- 
erator of bad Internet traffic and place it into the bad traf- 
fic database, thus preventing further bad Internet traffic 
from that affiliate site. 



Brief Description of Drawings 

[0010] For the purpose of facilitating an understanding of tlie 

subject matter sought to be protected, there is illustrated 
in the accompanying drawings an embodiment thereof, 
from an inspection of which, when considered in connec- 
tion with the following description, the subject matter 
sought to be protected, its construction and operation, 
and many of its advantages, should be readily understood 
and appreciated. 

[0011] FIG. 1 is a flowchart depicting the preferred detection of 
bad Internet traffic method of the present invention; and 

[0012] FIG. 2 is a flowchart depicting the preferred analysis of 

gathered data in determining if a web site is likely to send 

bad Internet traffic of the present invention. 
Detailed Description 

[0013] The present invention is a method of detecting or moni- 
toring bad Internet traffic directed from a first web site to 
a second web site. The present invention identifies traffic 
sources that are likely sending automated or incentivized 
clicks, such as with hypertextual links or advertisements 
displayed on a first web site to a second web site. Once a 
fraudulent source is identified, the fraud source can be 



blocked from sending future bad Internet traffic on adver- 
tiser listings. 

[0014] In an embodiment, a method of detecting likely bad Inter- 
net traffic sent from a first web site to a second web site 
is provided. In an embodiment, a typical Pay Per Click In- 
ternet advertisement system may be employed in that the 
first web site may be an affiliate that displays an adver- 
tisement or hypertext link to an advertiser and the second 
web site may be the advertiser. It will be appreciated that 
while the present application discusses the present inven- 
tion in terms of a Pay Per Click advertisement system, the 
present invention can be employed and used in any first 
web site sending or referring Internet traffic to a second 
web site system. Accordingly, it will be understood that 
the terms "first web site" may be used interchangeably 
with affiliate web site and "second web site" may be used 
interchangeably with "advertiser site," without departing 
from the true scope and spirit of the present invention. 

[0015] Referring to Fig. 1, the method includes providing an af- 
filiate site that has at least one hypertext link or adver- 
tisement link to an advertiser site 1. In an embodiment, 
the affiliate site may display a link, such as an advertise- 
ment, to the advertiser site after receiving a keyword 



search from the Internet user. In such an embodiment, the 
affiliate site receives a keyword search from the Internet 
user, prepares a result list based upon the keyword search 
and then provides at least one link on the affiliate site that 
is relevant or related to the keyword search. In such an 
embodiment, before a referral click occurs, an Internet 
user has already shown an interest in a given topic 
through the use of a keyword. 
[0016] The method further includes providing an affiliate bad 

traffic database that has a listing of affiliate sites that are 
known or likely to send bad Internet traffic to advertiser 
sites. The method also includes transferring the Internet 
user to an intermediate web site, after the Internet user 
clicks on the link or advertisement placed on the affiliate 
site, 2 that gathers information from the Internet user's 
web browser in order to determine if a validation request 
is required in order to detect if the affiliate site is likely 
sending bad Internet traffic 3. The intermediate web site 
may include a redirect page that is not immediately dis- 
played to the Internet user but is rather hidden in that the 
Internet user does not necessarily realize that there was 
an intermediate page. In other words, the intermediate 
page may be configured to determine if a validation re- 



quest is required witliout the Internet user's Icnowledge or 
input into sucli determination. 
[0017] If information gatliered from tlie intermediate web page 
indicates tliat a validation request is warranted, then a 
validation request may be initiated 3a. If information 
gathered from the intermediate web page indicates that a 
validation request is not warranted, a validation request 
may nonetheless be randomly initiated 4. However, it is 
anticipated that most non-suspect referral clicks do not 
require validation and follow a standard sequence of 
events wherein the intermediate web site simply collects 
information 6 and causes the transfer of the advertiser 
site to the Internet user without any further intervention 
11. In another embodiment, validation requests may au- 
tomatically be initiated for many reasons, such as, for ex- 
ample, an advertiser complains about the amount or qual- 
ity of an affiliate's traffic, an affiliate has a sudden surge 
of Internet traffic directed to an advertiser web site, an af- 
filiate has an unusually low conversion rate (the amount of 
actually interested consumers compared to the amount of 
clicks), the Internet browser information for clicks is iden- 
tical even though their respective Internet protocol ad- 
dresses are different (typically indicating that a single In- 



ternet user is using a plurality of IP address), data gath- 
ered from a prior random validation request is not satis- 
factory, or if the affiliate site is placed within the affiliate 
bad traffic database. 
[0018] Information that may be gathered by the intermediate web 
site from the Internet user's browser in order to determine 
if a validation request is warranted or if an affiliate site is 
likely to send bad Internet traffic may include, among 
other things, the date and time of the click, the adver- 
tiser's Uniform Resource Locator (URL), the input keyword, 
the Internet user's Internet Protocol address (IP), the affili- 
ate's identification number, the type of keyword service 
that is used (e.g. a input search box or a textual link), the 
compensation that the affiliate receives if the affiliate suc- 
cessfully causes an Internet user to click on an advertise- 
ment or link, the numeric ranking of the advertisement 
relative to other advertisement listings, the URL of the 
web page that the Internet user visited prior to viewing 
the displayed advertisement, the "http_user_agent" or In- 
ternet browser information (e.g. Internet browser type and 
version), the "http_accept_language" or Internet user's 
browser language preference, the amount of time the In- 
ternet user spends on the advertiser site, if the Internet 



user's browser has cookies enabled, the number of times 
that the affiliate site refers the Internet user to the adver- 
tiser site, if there is mouse movement, if the referred ad- 
vertiser is relevant to a keyword search conducted by the 
Internet user, and an Internet user identification that is 
subsequently tracked and recorded through the use of In- 
ternet cookies. 

[0019] An example of information that may be gathered from the 
Internet user's browser may be in the form of an Internet 
link, such as: 

http://www.revenuepilot.com/jsp/index.jsp?keyword=Rin 
gs&id=1394&filtered=yes. In this example, the URL of the 
web page where the Internet user viewed and clicked on 
the advertisement is "revenuepilot.com" and the affiliate 
identification number is 1394. Further in this example, 
the searched keyword ("Rings"), the affiliate ID ("1394"), 
and the advertiser's URL are embedded in the advertiser's 
listing link and are later stored in a database as part of 
the information for later analysis. 
[0020] Once a validation request is initialized, a survey, typically 
in the form of an Internet pop-up that requires manual 
entries to be inserted by the Internet user 5, may be used. 
The validation survey may collect voluntary and involun- 



tary information from the Internet user as well as click de- 
tails. The survey may, for example, request the Internet 
user to manually answer information pertaining to what 
keyword was searched for, what paid-to-surf program an 
Internet user is using, or other general questions which 
require human interaction such as is the Earth flat or 
round or asking the Internet user to replicate alphanu- 
meric characters shown in an image. Involuntary informa- 
tion about the Internet user may be collected such as the 
width and height of the survey pop-up window, whether 
the Internet user moved its mouse over any portion of the 
survey window, whether the Internet user's browser had 
cookies-acceptance enabled, the Internet user's browser 
information, and how many seconds the Internet user re- 
mained on the survey form before submitting the infor- 
mation. Further information that is collected may include 
the affiliate identification that referred the Internet user 
and the advertiser identification that had its advertisement 
displayed on the affiliate site. 
[0021] If the Internet user submits the survey information, the 
information is gathered from the survey and stored in a 
survey database for subsequent analysis 13. At this point, 
the Internet user is redirected back to the intermediate 



page where the Internet user and browser information is 
collected and stored for subsequent analysis 6, the Inter- 
net user is redirected to the desired advertiser site 11, 
and the affiliate site will be compensated by the advertiser 
site for the referral. If, on the other hand, the survey form 
is displayed and the Internet user does not submit it, the 
advertiser web site is not caused to be transmitted to the 
Internet user, the advertiser does not compensate the af- 
filiate for a referral and the session terminates 14. 
[0022] Information gathered from the intermediate web page 6 
and survey submissions 13 may be subsequently ana- 
lyzed. Such an analysis may, for example, predict the 
quality of the advertisement referrals sent from an affili- 
ate's site. For example, if an affiliate's referral traffic has 
poor percentages in a category, the affiliate's information 
may be listed in the affiliate bad traffic database which 
will subsequently cause a validation request to be initiated 
on future referrals 3a. Such categories may includes, for 
example, an analysis of unique IP addresses compared to- 
tal clicks, indicating the number of unique Internet users, 
unique Internet users compared to the total clicks, aver- 
age cost per click, missing http.referer information indi- 
cating a fraudulent source, clicks to searches ratio, total 



relative browser language clicks, and percentage of clicks 
coming from a single IP address. If an analysis of the in- 
formation warrants future validation requests from an af- 
filiate site, only a portion of referrals sent from an affiliate 
site to an advertiser site may require validation. In another 
embodiment, all referrals sent from an affiliate site to an 
advertiser site will require validation. 
[0023] In an embodiment, validation requests can be automati- 
cally initiated based upon the affiliate identification num- 
ber, the domain or sub-affiliate identification information 
found in the http.referer, or advertiser URL, which may be 
located in the affiliate bad traffic database. For example, if 
referral traffic from an affiliate site is suspected to be bad 
Internet traffic, the affiliate identification information can 
be inserted into the affiliate bad traffic database, thus re- 
quiring a validation request to be initiated on subsequent 
referrals that match that affiliate identification informa- 
tion. In another example, if an advertiser is particularly 
vulnerable to bad Internet traffic, the advertiser's URL can 
be placed in the affiliate bad traffic database to require 
validation requests on subsequent referrals for advertisers 
that match the advertiser's URL. In yet another example, if 
a sub-affiliate (an affiliate of an affiliate site) is suspected 



of causing bad Internet traffic, tlie sub-affiliate's identifi- 
cation information or domain name, as extracted from tlie 
http.referer information, can be placed in the affiliate bad 
traffic database in order to require validation requests on 
future referrals for affiliate sites that match the sub- 
affiliate's identification information. 
[0024] As an illustration, if an affiliate site having an affiliate 

identification number of 41867 and data extracted from 
the Internet user's browser indicate a language preference 
of Russian, because the referred advertiser site is in En- 
glish, it would be likely that these Russian language refer- 
rals are bad Internet traffic because the Internet users 
would not likely be able to read and understand the con- 
tent. After further examination, the administrator may de- 
termine that most of the Russian referrals have 
http.referers similar to: 

http://www.chocolateicecream.com?kywd=banana+flavor 
&id=4456&x=no. Here, the http.referer information ob- 
tained from the Internet user's browser indicates that 
clicks emanating from "chocolateicecream.com" appear to 
have Russian language data when the sub-affiliate id 
"4456" is found in the click's http.referer information. As 
such, the sub-affiliate identification number of "id=4456" 



can be placed in the affiliate bad traffic database in order 
to require future validation requests for all referrals hav- 
ing http.referer information containing "id=4456." In yet 
another illustration, the information obtained from the 
http.referer 

http: / /\AAAAA/.chocolateicecream .com?kywd = banana+f lavor 
&id=4456&x=no may indicate that the affiliate domain of 
"chocolateicecream.com" may be the source of bad Inter- 
net traffic. In this case, the domain name "chocolateice- 
cream.com" can be placed into the affiliate bad traffic 
database and require future validation requests for all re- 
ferrals having http_referer information containing the do- 
main name "chocolateicecream.com." While in either sce- 
nario, a validation request will be initiated if the 
http.referer information matches the set criteria, a prop- 
erly executed and completed survey form by the Internet 
user will still result in the Internet user being redirected to 
the clicked advertisement site. In another embodiment, if 
the http.referer information matches the set criteria, the 
traffic can immediately be prevented an the Internet user's 
session can be terminated to prevent a referral to the ad- 
vertiser site. 

[0025] Subsequent analysis of the information obtained from the 



Internet user's browser and completed survey forms may 
yield a determination that an affiliate is likely to send bad 
Internet traffic to an advertiser site. For example, if it is 
recorded that an advertiser site has 552 total referrals, 
out of which 247 were referred by the affiliate "chocolate- 
icecream. com," and out of the 247 only 10% recorded 
mouse movement with the survey form, it can be deduced 
that the affiliate site "chocolateicecream.com" is likely 
sending bad Internet traffic through the use of an auto- 
mated program because the survey form mouse move- 
ment is unexpectedly low. 
[0026] In an embodiment, analysis of the information obtained 
from the Internet user's browser and completed validation 
surveys can be completed via a computer program. The 
computer program may provide a summarized or detailed 
analysis of an affiliate site's traffic for review. For exam- 
ple, the computer program may generate a report in the 
form of a typical text file that shows validation statistics 
analyzed by domain names or affiliate identification infor- 
mation found in the http.referer. The computer may, for 
example, summarize or analyze the number of validation 
survey requests initiated, the percentage of those surveys 
that were completed and submitted by the Internet user. 



the percentage of the validation surveys that detected 
mouse movement, the percentage of validation surveys 
that were from Internet browsers with cookies enabled, 
answers input by the Internet user to a paid-to-surf pro- 
gram name question, or a comparison between what the 
Internet user input it was searching for and the advertise- 
ment that was used. Once analysis of the information has 
been completed, bad Internet traffic sources can be iden- 
tified and an affiliate site that is prone to send such bad 
Internet traffic can be dealt with. For example, if an affili- 
ate site's human response rate is low, the affiliate site may 
be requested to block such bad Internet traffic source 
from showing the advertisement, especially if the mouse 
movement rate is low or if the cookies enabled rate is low 
or high, which would typically signify automated clicks. 
Further, if it determined that an affiliate site is uncoopera- 
tive or if all of the affiliate's site referrals are bad Internet 
traffic, affiliate site's account may be canceled wherein the 
affiliate site will no longer receive compensation for any 
advertisement referrals. 
[0027] It vvill be appreciated that the above listed examples and 
illustrations are for exemplification purposes only and are 
not intended to limit the scope and spirit of the present 



application. 

[0028] The matter set forth in the foregoing description and ac- 
companying drawings is offered byway of illustration only 
and not as a limitation. While particular embodiments 
have been shown and described, it will be apparent to 
those skilled in the art that changes and modifications 
may be made without departing from the broader aspects 
of applicants" contribution. The actual scope of the pro- 
tection sought is intended to be defined in the following 
claims when viewed in their proper perspective based on 
the prior art. 



